feat(cli): add smoke tests across multiple distros #239
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,169 @@ | ||
| name: CLI Distro Smoke Tests | ||
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, synchronize] | ||
| paths: | ||
| - "**.go" | ||
| - "go.mod" | ||
| - "go.sum" | ||
| - ".goreleaser.yaml" | ||
| - "packages/pam/handlers/rdp/native/**" | ||
| - "smoke-tests/**" | ||
| - ".github/workflows/run-cli-smoke-tests.yml" | ||
|
|
||
| workflow_dispatch: | ||
| workflow_call: | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build CLI + packages | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | ||
| with: | ||
| go-version: "1.25.9" | ||
|
|
||
| - name: Cache cargo registry + target | ||
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | ||
| with: | ||
| path: | | ||
| ~/.cargo/registry | ||
| ~/.cargo/git | ||
| packages/pam/handlers/rdp/native/target | ||
| key: rdp-smoke-cargo-${{ runner.os }}-${{ hashFiles('packages/pam/handlers/rdp/native/Cargo.lock') }} | ||
| restore-keys: rdp-smoke-cargo-${{ runner.os }}- | ||
|
|
||
| - name: Install pinned Rust toolchain | ||
| working-directory: packages/pam/handlers/rdp/native | ||
| run: rustup show active-toolchain | ||
|
|
||
| - name: cargo fmt --check | ||
| working-directory: packages/pam/handlers/rdp/native | ||
| run: cargo fmt --check | ||
|
|
||
| - name: cargo clippy -D warnings | ||
| working-directory: packages/pam/handlers/rdp/native | ||
| run: cargo clippy --all-targets -- -D warnings | ||
|
|
||
| - name: Install cross | ||
| run: cargo install cross --locked --version 0.2.5 | ||
|
|
||
| - name: Build RDP bridge for musl | ||
| working-directory: packages/pam/handlers/rdp/native | ||
| run: cross build --release --target x86_64-unknown-linux-musl | ||
|
|
||
| - name: Install musl cross-compiler | ||
| run: | | ||
| set -euo pipefail | ||
| MUSL_CROSS_TAG=20260430 | ||
| sudo mkdir -p /opt/musl-cross | ||
| triple=x86_64-unknown-linux-musl | ||
| sha=2495cfe18fc1f406d5cab93d902176af75a78f0ae93137f3e8b2df7708ec32fa | ||
| tarball="/tmp/${triple}.tar.xz" | ||
| curl --retry 5 --retry-delay 10 --retry-all-errors \ | ||
| --connect-timeout 30 --max-time 240 \ | ||
| -fsSL "https://github.com/cross-tools/musl-cross/releases/download/${MUSL_CROSS_TAG}/${triple}.tar.xz" \ | ||
| -o "$tarball" | ||
| echo "${sha} ${tarball}" | sha256sum -c - | ||
| sudo tar -xJ -f "$tarball" -C /opt/musl-cross | ||
| rm -f "$tarball" | ||
| echo "/opt/musl-cross/${triple}/bin" >> "$GITHUB_PATH" | ||
|
|
||
| - name: Build static binary | ||
| run: | | ||
| CGO_ENABLED=1 \ | ||
| CC=x86_64-unknown-linux-musl-gcc \ | ||
| CGO_LDFLAGS="-L packages/pam/handlers/rdp/native/target/x86_64-unknown-linux-musl/release" \ | ||
| go build -trimpath \ | ||
| -tags=rdp,osusergo,netgo \ | ||
| -ldflags "-X github.com/Infisical/infisical-merge/packages/util.CLI_VERSION=0.0.0-smoke -extldflags '-static'" \ | ||
| -o infisical . | ||
|
|
||
| - name: Install nfpm | ||
| run: | | ||
| go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.46.3 | ||
|
|
||
| - name: Create packages | ||
| run: | | ||
| mkdir -p smoke-tests/dist | ||
| nfpm package --config smoke-tests/nfpm.yaml --packager deb --target smoke-tests/dist/infisical.deb | ||
| nfpm package --config smoke-tests/nfpm.yaml --packager rpm --target smoke-tests/dist/infisical.rpm | ||
| nfpm package --config smoke-tests/nfpm.yaml --packager apk --target smoke-tests/dist/infisical.apk | ||
| nfpm package --config smoke-tests/nfpm.yaml --packager archlinux --target smoke-tests/dist/infisical.pkg.tar.zst | ||
|
|
||
| - name: Upload packages | ||
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | ||
| with: | ||
| name: smoke-test-packages | ||
| path: | | ||
| smoke-tests/dist/ | ||
| smoke-tests/smoke.sh | ||
| retention-days: 1 | ||
|
|
||
| smoke-test: | ||
| name: ${{ matrix.distro }} | ||
| needs: build | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - distro: ubuntu-22.04 | ||
| image: ubuntu:22.04 | ||
| pkg: infisical.deb | ||
| install: "dpkg -i" | ||
|
|
||
| - distro: ubuntu-24.04 | ||
| image: ubuntu:24.04 | ||
| pkg: infisical.deb | ||
| install: "dpkg -i" | ||
|
|
||
| - distro: debian-12 | ||
| image: debian:12 | ||
| pkg: infisical.deb | ||
| install: "dpkg -i" | ||
|
|
||
| - distro: fedora-40 | ||
| image: fedora:40 | ||
| pkg: infisical.rpm | ||
| install: "rpm -i" | ||
|
|
||
| - distro: rockylinux-9 | ||
| image: rockylinux:9 | ||
| pkg: infisical.rpm | ||
| install: "rpm -i" | ||
|
|
||
| - distro: amazonlinux-2023 | ||
| image: amazonlinux:2023 | ||
| pkg: infisical.rpm | ||
| install: "rpm -i" | ||
|
|
||
| - distro: alpine-3.20 | ||
| image: alpine:3.20 | ||
| pkg: infisical.apk | ||
| install: "apk add --allow-untrusted" | ||
|
|
||
| - distro: archlinux | ||
| image: archlinux:latest | ||
| pkg: infisical.pkg.tar.zst | ||
| install: "pacman -U --noconfirm" | ||
|
|
||
| steps: | ||
| - name: Download packages | ||
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | ||
| with: | ||
| name: smoke-test-packages | ||
| path: artifacts | ||
|
|
||
| - name: Run smoke tests on ${{ matrix.distro }} | ||
| run: | | ||
| chmod +x artifacts/smoke.sh | ||
| docker run --rm \ | ||
| -v "${{ github.workspace }}/artifacts/dist:/dist" \ | ||
| -v "${{ github.workspace }}/artifacts/smoke.sh:/smoke.sh" \ | ||
| ${{ matrix.image }} \ | ||
| sh -c "${{ matrix.install }} /dist/${{ matrix.pkg }} && /smoke.sh" | ||
|
x032205 marked this conversation as resolved.
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| name: infisical | ||
| arch: amd64 | ||
| platform: linux | ||
| version: v0.0.0-smoke | ||
| maintainer: "Infisical, Inc" | ||
| description: "The official Infisical CLI" | ||
| homepage: "https://infisical.com/" | ||
| license: MIT | ||
|
|
||
| contents: | ||
| - src: ./infisical | ||
| dst: /usr/bin/infisical |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| #!/bin/sh | ||
| set -e | ||
|
|
||
| DISTRO="unknown" | ||
| if [ -f /etc/os-release ]; then | ||
| DISTRO=$(. /etc/os-release && echo "$PRETTY_NAME") | ||
| fi | ||
|
|
||
| echo "=== CLI Smoke Tests ===" | ||
| echo "Distro: $DISTRO" | ||
| echo "Arch: $(uname -m)" | ||
| echo "" | ||
|
|
||
| passed=0 | ||
| failed=0 | ||
|
|
||
| pass() { | ||
| passed=$((passed + 1)) | ||
| echo "PASS: $1" | ||
| } | ||
|
|
||
| fail() { | ||
| failed=$((failed + 1)) | ||
| echo "FAIL: $1" | ||
| } | ||
|
|
||
| if ! command -v infisical >/dev/null 2>&1; then | ||
| fail "infisical binary not found in PATH" | ||
| exit 1 | ||
| fi | ||
| pass "binary found at $(command -v infisical)" | ||
|
|
||
| # --version | ||
| if output=$(infisical --version 2>&1); then | ||
| pass "--version ($output)" | ||
| else | ||
| fail "--version exited with $?" | ||
| fi | ||
|
|
||
| # --help | ||
| if infisical --help >/dev/null 2>&1; then | ||
| pass "--help" | ||
| else | ||
| fail "--help" | ||
| fi | ||
|
|
||
| # core subcommands | ||
| for cmd in secrets run export login agent gateway pam; do | ||
| if infisical "$cmd" --help >/dev/null 2>&1; then | ||
| pass "$cmd --help" | ||
| else | ||
| fail "$cmd --help" | ||
| fi | ||
| done | ||
|
|
||
| # RDP bridge subcommand (verifies the Rust bridge linked correctly) | ||
| if infisical pam rdp access --help >/dev/null 2>&1; then | ||
| pass "pam rdp access --help" | ||
| else | ||
| fail "pam rdp access --help" | ||
| fi | ||
|
|
||
| # shared library check | ||
| BINARY_PATH=$(command -v infisical) | ||
| if command -v ldd >/dev/null 2>&1; then | ||
| ldd_output=$(ldd "$BINARY_PATH" 2>&1 || true) | ||
| if echo "$ldd_output" | grep -qi "not a dynamic executable\|statically linked\|not a valid dynamic program"; then | ||
| pass "static binary (no dynamic dependencies)" | ||
| elif echo "$ldd_output" | grep -qi "not found"; then | ||
| fail "missing shared libraries" | ||
| echo "$ldd_output" | ||
| else | ||
| pass "no missing shared libraries" | ||
|
Contributor
There was a problem hiding this comment. I think this should be fail, no? We don't know what shared libraries are available on what distros so we should just be disallowing any dynamically linked libraries at all, not relying on guess and check if they're available or not. |
||
| fi | ||
|
x032205 marked this conversation as resolved.
|
||
| fi | ||
|
|
||
| echo "" | ||
| echo "Results: $passed passed, $failed failed" | ||
|
|
||
| if [ "$failed" -gt 0 ]; then | ||
| exit 1 | ||
| fi | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The old smoke tests also ran on
ubuntu:20.04, rockylinux:8, amazonlinux:2, and distroless. The original issue we ran into with the dynamically linked libc only happened on ubuntu 20 and below, so we should at least add that. The other ones probably aren't as important but they run in parallel so I don't see the harm in adding them